Cert Authority - W2K3 to W2K8, Enterprise Root to Enterprise Subordinate

i admin small company less 100 clients , half dozen servers.  i’m presently running self-signed windows server 2003 certificate authority (enterprise root ca).  the main purpose of having ca allow encryption of outlook web access , pop3 traffic.  i run ca on exchange 2003 box.  the biggest problem have design external clients (outside of ad domain) don’t trust ca unless manually install trusted root cert on external clients.

 

i’m planning upgrade w2k8 , exchange server 2010.  (i getting new server hardward, not running in-place upgrade).  i change certificate structure external clients trust certs.  the new config envision it:

• purchase certificate third party cert authority (eg verisign).
• create own enterprise subordinate ca in w2k8
• use third party ca root ca
• host both ca , exchange on same box

if understanding correct, new structure allow external clients find trusted root ca automatically, since it’s public.

 

1) new design makes sense?  if not, change?

2) don’t know how there here.  i assume have discard issued certs, , clients need new certs new ca.  true?

 

any appreciated !

 

thanks!

---

mcitp enterprise admin/server admin, mcse nt, 2000, 2003

on tue, 16 nov 2010 19:38:38 +0000, guitarfish wrote:

purchase certificate third party cert authority (eg verisign).  * create own enterprise subordinate ca in w2k8  * use third party ca root ca  * host both ca , exchange on same box 

if understanding correct, new structure allow external clients find trusted root ca automatically, since it?s public.

you're thinking of known root signing you're
confused how works. root signing contract a
trusted external root authority have them sign , issue subordinate
ca certificate use subordinate issuing ca. you
cannot purchase certificate trusted external root authority
, use root ca certificate, no 1 sells such thing.

for organization of size you're going find root signing is
going be:

a) cost prohibitive.
b) effort maintain given number of certificates you're
going require.

?

1) new design makes sense??if not, change?

your best solution purchase certificates you
need external party, @ least services need be
externally accessible.

---

paul adare
mvp - identity lifecycle manager
http://www.identit.ca

Windows Server  >  Security